Cyber Expert Says Mobile’s $14.7 Million Arena Loss Fits Business Email Compromise Pattern

MOBILE, Ala. — City officials still have not said how Mobile lost $14.7 million to scammers in a single Regions Arena payment. A longtime cybercrime researcher says the facts made public so far match a fraud that is common and costly: business email compromise, in which criminals pose as a trusted contractor and redirect a payment to an account they control.

Gary Warner taught online security at the University of Alabama at Birmingham for 18 years. He stressed that he does not know the details of Mobile’s case and that his read is hypothetical. Still, he said the outline Mayor Spiro Cheriogotis has given fits a pattern Warner has seen “in case after case after case.”

What the city has said, and hasn’t

Cheriogotis has been open about the basic facts. He has said the $14.7 million was one of a series of payments for construction of the new Regions Arena, and that a “criminal scheme” sent it to “a fraudulent entity.”

He has not said how the scheme worked. Speaking to reporters Wednesday, Oct. 21, the mayor said, “We have a fairly clear picture of how this happened internally,” but he declined to give details because several investigations are underway.

“As far as whether this was a confidence scam, impersonation, phishing, you know, I’m going to leave that detail out for the moment,” he said. “Again, it’s our intention to be transparent about this. And as things happen and we are in a position to share them, we absolutely will.”

The city has repeatedly called the loss a scam, and no one has been charged. That suggests officials do not consider it embezzlement by someone inside City Hall. That leaves several possibilities, including a targeted phishing attack, a fake invoice or another kind of wire fraud aimed at diverting a legitimate payment.

The case for business email compromise

Since retiring from UAB in 2025, Warner has worked as director of intelligence for DarkTower, a private company that fights cybercrime. He said the known facts point to business email compromise, or BEC, which is also called invoice redirection fraud.

One reason is the target. Warner said big construction projects are among BEC fraudsters’ favorite targets because they involve large payments made regularly over months or years.

BEC can look like spear phishing, which is a phishing attack built to fool one specific person. Cybersecurity firm Kaspersky describes general phishing as an attempt to get someone inside an organization to reveal sensitive information or make an unsafe transaction. In spear phishing, attackers first research the people who have authority to move money. Then they send fake messages, or even fake phone calls, that seem to come from a boss or other higher-up.

“What makes spear phishing scams so successful — more so than standard phishing attacks — is that the attackers conduct extensive research on their intended targets,” Kaspersky’s site says.

BEC works from the other direction, Warner said. The criminals do not start by hacking the organization that pays. They hack the company that gets paid.

How the scheme typically unfolds

On a public construction project, Warner said, the attackers try to break into a contractor’s email system. If they get in, they quietly study the payment process: who sends the money, when it is sent and where it goes.

When they act, they ask the paying organization to send the next payment to a new account. Because they are using the contractor’s real email, the request looks like it comes from the company that is normally paid.

“Then what happens is that they will send an email usually replying to the same email thread, so that the email that the person in the city of Mobile receives would look like it’s a reply to an email that they sent to the contractor,” Warner said.

That makes the fraud hard to catch. The criminals can mention real, ongoing conversations and copy familiar steps. Warner said they sometimes include the old, correct banking details alongside the new, fraudulent ones to make the change look routine.

Why the loss may not be noticed for weeks

Warner said the scheme often goes undiscovered for a while because of how business works between big clients and contractors.

“Here’s where things get crazy, and we’ve seen this in case after case after case,” Warner said. “Okay, so let’s say that you’re a major contractor and your draw is $5 million a month. If you’re doing business for a city or a major university and they’re a little bit late with their $5 million payment, do you think they’re good for it? Yeah, probably. So you might not want to say, ‘Hey, you’re a day late with your $5 million payment.’ You give them a couple of days.”

He said many contractors wait even longer, until a second invoice is overdue, before asking. Only then does the paying organization learn that the money it thought it sent to the contractor’s “new bank account” went somewhere else.

Warner repeated that he was speaking hypothetically and was not accusing anyone involved in the arena project.

The arena contractor declines comment

The principal contractor on the Regions Arena is B.L. Harbert International, a Birmingham-based construction firm overseeing a $237 million contract. When called at its Birmingham office on Thursday, Oct. 22, the company firmly declined to comment on anything about the arena project.

Nothing made public so far shows that any contractor’s systems were compromised. City officials have not said who received the money or how the payment instructions were changed.

Getting the money back will be hard

Cheriogotis has said contingency funds built into the arena budget will let construction continue. He said the city has a year “to recover every dollar that we can through the criminal investigations, through our insurance carriers and every other means at our disposal,” but called that “no easy feat.”

Warner’s experience backs that up. If the alarm goes off more than about 48 hours after a transfer, as appears to have happened here, he said even an agency as powerful as the FBI may be able to do very little. By then, the money has usually been moved through other accounts.

A national problem, and an Alabama one

Warner cited FBI figures showing BEC was the second most damaging type of cyber-enabled fraud in 2025, with more than $3 billion in reported losses. Only cyber-enabled investment schemes did more damage, at $8.6 billion, much of it tied to cryptocurrency. The FBI’s Internet Crime Complaint Center received more than 1 million complaints in 2025.

In Alabama alone, the FBI received 301 business email compromise complaints in 2025, with reported losses of more than $37 million, according to the figures Warner cited.

“If we boil it down to the basics there, it’s the number two crime in America by the amount of money that gets stolen,” Warner said. “And the criminals are definitely targeting large real estate deals and large construction deals.”

Warner said many of these schemes come from Africa, a view supported by a report Interpol released Thursday.

Other cities that lost millions

Mobile is far from the only local government targeted. Cities are frequent targets of cyber scams and older forms of financial crime, and losses often reach several million dollars.

• Dixon, Illinois: Rita A. Crundwell, the city’s longtime comptroller and treasurer, diverted more than $53 million over about 22 years to pay for a lavish lifestyle. The ForensisGroup calls it “the largest municipal embezzlement case in U.S. history.” Unlike Mobile’s case, that was an inside job.
• Portland, Oregon: In 2025, someone posing as a Water Bureau contractor persuaded city staff to send $6.7 million in payments to an unknown bank account. The money was recovered.
• Lexington, Kentucky: In 2022, scammers used forged documents, false identities and fake email accounts to pose as a nonprofit that worked with the city. They tricked officials into diverting $3.9 million in federal housing assistance. Several people were convicted, and the money was recovered.
• Baltimore, Maryland: A 2019 ransomware attack cost the city a reported $18 million. Ransomware is a different kind of crime, in which attackers lock up a victim’s computer systems and demand payment. Cheriogotis has said Mobile was not hit by ransomware.

The same scam hits home buyers

Warner said the same approach is used against ordinary people, especially in real estate.

“You’re closing a real estate deal and you need to send your earnest money to a certain address, and you get an email because they’ve hacked the title company,” he said. “And, and they say, ‘Oh, what was on the paperwork is the wrong bank account. You need to send your earnest money to this account instead.’ Or your closing money, which is even worse.”

The one safeguard that matters most

Warner said the only safe approach is to check every request to change payment instructions carefully, even when it seems to come from someone you trust.

“Every time there is a request to change the banking details from what the original one was, that’s got to be voice-validated,” he said. “And maybe even, for that kind of money, in person, face to face. Because that’s our other issue these days, is with deepfakes. I can take a very short phone call and use that to generate a new voice. So I can imitate the voice of a person.”

“I’m not saying that’s what happened with city of Mobile, but that’s how these things happen now,” he added.

What to know: protecting a business or household from payment fraud

• Treat any change in bank details as a red flag, even if it arrives in an existing email thread from a familiar sender.
• Call to confirm using a number you already have, such as one from an original contract or an official website, not one listed in the email asking for the change.
• Be careful with voices, too. Warner warns that a short recording can be enough to clone a voice, so for very large sums, consider confirming in person.
• Watch for urgency or secrecy. Pressure to pay quickly or to skip normal steps is a common sign of fraud.
• Move fast if something goes wrong. Contact your bank right away and file a complaint with the FBI’s Internet Crime Complaint Center at IC3.gov. Warner said the chances of recovering money drop sharply after the first 48 hours.

What comes next in Mobile

The FBI and the U.S. Secret Service are investigating, and the city has hired a national law firm and a forensic accounting firm, as South Alabama News has reported. City Council members plan to question the administration about the loss at their regular meeting Tuesday, Oct. 27. Cheriogotis has said the city will release more details on how the money was lost when it can.